Resubmissions

30-06-2024 01:18

240630-bn62va1erg 10

29-06-2024 22:53

240629-2t7tfaydje 10

29-06-2024 22:33

240629-2gkhdayald 10

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    29-06-2024 22:33

General

  • Target

    Borat.rar

  • Size

    9.6MB

  • MD5

    e3b10d235c365ac49d6855df0432bb76

  • SHA1

    4ce182c19796cf8d4c017fdd8fd4b390de1eac7e

  • SHA256

    53cdc49c7fb83b419c07edb45c544b106aaa37db00e8a37211678af6350a82f1

  • SHA512

    bb91a4bf979516c2a19733772b4c34b09b45efbcec491f2fb62adde9222e6306ce32a17de3e6f9b3d7338a93f3d72e4747a23157675663f00e9f153bc4ec4704

  • SSDEEP

    196608:XrmtNiLocMQin2MKY9U6Qw9w/ZpX4ff5c4lgg0:7mt5tn2y9Woff5c4G

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Borat.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Borat.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Borat.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2644-30-0x000007FEFBA90000-0x000007FEFBAC4000-memory.dmp

    Filesize

    208KB

  • memory/2644-29-0x000000013F260000-0x000000013F358000-memory.dmp

    Filesize

    992KB

  • memory/2644-32-0x000007FEFBF10000-0x000007FEFBF28000-memory.dmp

    Filesize

    96KB

  • memory/2644-33-0x000007FEFB810000-0x000007FEFB827000-memory.dmp

    Filesize

    92KB

  • memory/2644-35-0x000007FEF8160000-0x000007FEF8177000-memory.dmp

    Filesize

    92KB

  • memory/2644-34-0x000007FEFB770000-0x000007FEFB781000-memory.dmp

    Filesize

    68KB

  • memory/2644-36-0x000007FEF8140000-0x000007FEF8151000-memory.dmp

    Filesize

    68KB

  • memory/2644-38-0x000007FEF8100000-0x000007FEF8111000-memory.dmp

    Filesize

    68KB

  • memory/2644-37-0x000007FEF8120000-0x000007FEF813D000-memory.dmp

    Filesize

    116KB

  • memory/2644-31-0x000007FEF6A60000-0x000007FEF6D14000-memory.dmp

    Filesize

    2.7MB

  • memory/2644-40-0x000007FEF55D0000-0x000007FEF57D0000-memory.dmp

    Filesize

    2.0MB

  • memory/2644-48-0x000007FEF7EC0000-0x000007FEF7ED1000-memory.dmp

    Filesize

    68KB

  • memory/2644-51-0x000007FEF5560000-0x000007FEF55C7000-memory.dmp

    Filesize

    412KB

  • memory/2644-50-0x000007FEF7370000-0x000007FEF73A0000-memory.dmp

    Filesize

    192KB

  • memory/2644-47-0x000007FEF7EE0000-0x000007FEF7EFB000-memory.dmp

    Filesize

    108KB

  • memory/2644-46-0x000007FEF7F00000-0x000007FEF7F11000-memory.dmp

    Filesize

    68KB

  • memory/2644-45-0x000007FEF7F20000-0x000007FEF7F31000-memory.dmp

    Filesize

    68KB

  • memory/2644-60-0x000007FEF5450000-0x000007FEF5462000-memory.dmp

    Filesize

    72KB

  • memory/2644-59-0x000007FEF5470000-0x000007FEF5481000-memory.dmp

    Filesize

    68KB

  • memory/2644-58-0x000007FEF69C0000-0x000007FEF69E3000-memory.dmp

    Filesize

    140KB

  • memory/2644-57-0x000007FEF6ED0000-0x000007FEF6EE7000-memory.dmp

    Filesize

    92KB

  • memory/2644-56-0x000007FEF6A30000-0x000007FEF6A54000-memory.dmp

    Filesize

    144KB

  • memory/2644-55-0x000007FEF7320000-0x000007FEF7348000-memory.dmp

    Filesize

    160KB

  • memory/2644-54-0x000007FEF5490000-0x000007FEF54E6000-memory.dmp

    Filesize

    344KB

  • memory/2644-53-0x000007FEF7350000-0x000007FEF7361000-memory.dmp

    Filesize

    68KB

  • memory/2644-52-0x000007FEF54F0000-0x000007FEF555F000-memory.dmp

    Filesize

    444KB

  • memory/2644-49-0x000007FEF7EA0000-0x000007FEF7EB8000-memory.dmp

    Filesize

    96KB

  • memory/2644-39-0x000007FEF57D0000-0x000007FEF687B000-memory.dmp

    Filesize

    16.7MB

  • memory/2644-44-0x000007FEF7F40000-0x000007FEF7F51000-memory.dmp

    Filesize

    68KB

  • memory/2644-43-0x000007FEF8070000-0x000007FEF8088000-memory.dmp

    Filesize

    96KB

  • memory/2644-42-0x000007FEF8090000-0x000007FEF80B1000-memory.dmp

    Filesize

    132KB

  • memory/2644-41-0x000007FEF80C0000-0x000007FEF80FF000-memory.dmp

    Filesize

    252KB

  • memory/2644-67-0x000007FEF2680000-0x000007FEF2696000-memory.dmp

    Filesize

    88KB

  • memory/2644-66-0x000007FEF26A0000-0x000007FEF26B1000-memory.dmp

    Filesize

    68KB

  • memory/2644-65-0x000007FEF26C0000-0x000007FEF26EF000-memory.dmp

    Filesize

    188KB

  • memory/2644-64-0x000007FEFBB80000-0x000007FEFBB90000-memory.dmp

    Filesize

    64KB

  • memory/2644-63-0x000007FEF2F30000-0x000007FEF2F47000-memory.dmp

    Filesize

    92KB

  • memory/2644-62-0x000007FEF2F70000-0x000007FEF2F91000-memory.dmp

    Filesize

    132KB

  • memory/2644-68-0x000007FEF25B0000-0x000007FEF2675000-memory.dmp

    Filesize

    788KB

  • memory/2644-69-0x000007FEF2530000-0x000007FEF25A5000-memory.dmp

    Filesize

    468KB

  • memory/2644-71-0x000007FEF1D10000-0x000007FEF1D7D000-memory.dmp

    Filesize

    436KB

  • memory/2644-70-0x000007FEF2470000-0x000007FEF24D2000-memory.dmp

    Filesize

    392KB

  • memory/2644-72-0x000007FEEFD90000-0x000007FEEFF08000-memory.dmp

    Filesize

    1.5MB

  • memory/2644-61-0x000007FEF2FA0000-0x000007FEF4750000-memory.dmp

    Filesize

    23.7MB